SICK AG

Latest CVEs · RSS

• CVE-2026-101290 2026-10-15 · CVSS 7.5
  A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient v
• CVE-2026-80469 2026-09-11 · CVSS 8.3
  An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verification mechanisms, an
• CVE-2026-11841 2026-07-28 · CVSS 9.4
  An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access re
• CVE-2026-2331 2026-03-06 · CVSS 9.8
  An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access re
• CVE-2026-2330 2026-03-06 · CVSS 9.4
  An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories inten
• CVE-2026-1627 2026-02-27 · CVSS 6.5
  An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allo
• CVE-2026-1626 2026-02-27 · CVSS 6.5
  An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH comm
• CVE-2026-22646 2026-01-15 · CVSS 4.3
  Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable rec
• CVE-2026-22645 2026-01-15 · CVSS 5.3
  The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known secu
• CVE-2026-22644 2026-01-15 · CVSS 5.3
  Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer h
• CVE-2026-22919 2026-01-15 · CVSS 3.8
  An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the
• CVE-2026-22918 2026-01-15 · CVSS 4.3
  An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, lead
• CVE-2026-22917 2026-01-15 · CVSS 4.3
  Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.
• CVE-2026-22916 2026-01-15 · CVSS 4.3
  An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leadin
• CVE-2026-22915 2026-01-15 · CVSS 4.3
  An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information.
• CVE-2026-22914 2026-01-15 · CVSS 4.3
  An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.
• CVE-2026-22913 2026-01-15 · CVSS 4.3
  Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data.
• CVE-2026-22912 2026-01-15 · CVSS 4.3
  Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk includi
• CVE-2026-22911 2026-01-15 · CVSS 5.3
  Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to
• CVE-2026-22910 2026-01-15 · CVSS 7.5
  The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the risk of unauthorized access. This represent
• CVE-2026-22909 2026-01-15 · CVSS 7.5
  Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupti
• CVE-2026-22908 2026-01-15 · CVSS 9.1
  Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality.
• CVE-2026-22907 2026-01-15 · CVSS 9.9
  An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.
• CVE-2025-59463 2025-10-27 · CVSS 4.3
  An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.
• CVE-2025-59462 2025-10-27 · CVSS 6.5
  An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.